CS-320: Digital Forensics

This course introduces the principles, tools, and methodologies used in digital forensic investigations. Students learn how to collect, preserve, analyze, and document digital evidence while maintaining forensic integrity and chain-of-custody requirements. Topics include computer crime, forensic laboratory procedures, evidence acquisition, data recovery, incident response, and techniques used to conceal or obfuscate information. Students also examine forensic investigations involving Windows, Linux, macOS, email systems, mobile devices, networks, and memory analysis. Through hands-on exercises and case-based investigations, students develop practical skills for identifying, recovering, and analyzing digital evidence in support of cybersecurity operations, incident response, and legal proceedings.